Vulnerability Development: RE: Hacking USB Thumbdrives, Thumprint authentication

["Gavin S" <s7726 () yahoo com>]

I just have to say I think I would miss my dongle more.

Gavin S.

-----Original Message-----
From: Jon McClintock [mailto:jammer () weak org] 
Sent: Monday, January 26, 2004 10:31 AM
To: m e
Cc: vuln-dev () securityfocus com
Subject: Re: Hacking USB Thumbdrives, Thumprint authentication


On Sun, Jan 25, 2004 at 05:30:44AM -0000, m e wrote:
> http://www.thumbdrive.com/prd_info.htm
>
> Or any thumbprint biometric hacking.
A couple of points (note that I've not actually used/seen one of these
devices):

- Nowhere on the site does it mention encryption. So yes, you could
  probably crack the case and access the flash directly, most likely
  using off-the-shelf electronics test equipment.
- As mentioned by previous posters, current fingerprint biometrics are far
from
  secure.
- From a practical standpoint, it's much easier to loose one of these
  than to loose a laptop, and it's much easier to notice a missing laptop
  than a missing dongle. 
- Concentrating all of your secret data into one, easy-to-loose package
  seems riskier to me than having it interspersed amongst the background 
  noise of a typical OS install. 

-Jon